CVE-2014-5086: Sphider

High severity, CVSS 8.8. EPSS: 9.8% chance of exploitation in the next 30 days.

A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fwrite in Sphider Pro and Sphider Plus only, but don’t exist in Sphider.

Affected products

• Sphider Sphider: before 1.3.6 (fixed in 1.3.6)
• Sphider-Plus Sphider-Plus: before 3.2 (fixed in 3.2)
• Sphiderpro Sphider Pro: before 3.2 (fixed in 3.2)

Published 2020-02-10. Last modified 2026-06-17.